This vulnerability, identified as CWE-918 SSRF, exists in Themeum's Kirki product in versions up to 6.0.11. It allows an attacker with low privileges to induce the server to make unintended requests, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a CVSS 3.1 base score of 4.9 with network attack vector, high attack complexity, low privileges required, no user interaction, and a scope change. No vendor advisory or patch information is currently available, and no known exploits have been reported.

The impact includes limited confidentiality and integrity loss due to SSRF, which may allow an attacker to access internal resources or manipulate data indirectly. There is no reported impact on availability. The vulnerability requires network access, low privileges, and has high attack complexity, reducing the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor vendor communications for updates. No specific mitigation steps are provided by the vendor at this time.